🧩 lara-swagger itself is clean but lists lara-helper as a #Composer dependency — silently pulling in the RAT during installation
🔒 The payload in helper.php uses heavy obfuscation: control flow manipulation, encoded domain names, randomized variable/function identifiers to bypass static analysis
🌐 Once loaded, the RAT connects to C2 server helper.leuleu[.]net:2096, sends system reconnaissance data and awaits commands — full remote access granted to the attacker
michabbb
npub1z2…84yd9
2026-03-05 10:52:30 CET
in reply to nevent1q…ec8m
Author Public Key
npub1z20c8zvvwqydxdthrlngrm8e08nhv7ketrz49lu9m6tzhghhwklql84yd9Published at
2026-03-05 10:52:30 CETEvent JSON
{
"id": "2600ed832efed62f01a3eebb0a6a61525ff7debcd72b6f2c296fd86a74074565",
"pubkey": "129f83898c7008d335771fe681ecf979e7767ad958c552ff85de962ba2f775be",
"created_at": 1772704350,
"kind": 1,
"tags": [
[
"e",
"c213b8153cde5962ec5b5df50873b56637670ea49bfdb005d270024594e66355",
"wss://relay.ditto.pub",
"reply"
],
[
"t",
"composer"
],
[
"proxy",
"https://social.vivaldi.net/users/michabbb/statuses/116175952305811928",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "🧩 lara-swagger itself is clean but lists lara-helper as a #Composer dependency — silently pulling in the RAT during installation\n\n🔒 The payload in helper.php uses heavy obfuscation: control flow manipulation, encoded domain names, randomized variable/function identifiers to bypass static analysis\n\n🌐 Once loaded, the RAT connects to C2 server helper.leuleu[.]net:2096, sends system reconnaissance data and awaits commands — full remote access granted to the attacker",
"sig": "a08c96d7acbed563ac209c5f4572dcacdb22d48e8dd0280769b4432dd881c86d03005ccae4d3b3715ca9331a718608a4b3934fa87213e72192fd66ce496c228b"
}